
<!DOCTYPE html>
<html lang="en" class="loading">
<head>
    <meta charset="UTF-8" />
    <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" />
    <meta name="viewport" content="width=device-width, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no">
    <title>ssti学习 - EZzz</title>
    <meta name="apple-mobile-web-app-capable" content="yes" />
    <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
    <meta name="google" content="notranslate" />
    <meta name="keywords" content="Fechin,"> 
    <meta name="description" content="1.模板引擎
是为了使 用户界面和 业务数据（内容）分离而产生的，它可以生成特定格式的文档，利用模板引擎来生成前端的HTML代码，模板引擎会提供一套生成HTML代码的程序，之后只需获取用户的数据，放,"> 
    
    <link rel="alternative" href="atom.xml" title="EZzz" type="application/atom+xml"> 
    <link rel="icon" href="/img/favicon.png"> 
    
    
    
    <meta name="twitter:card" content="summary"/>
    <meta name="twitter:title" content="ssti学习 - EZzz"/>
    <meta name="twitter:description" content="1.模板引擎
是为了使 用户界面和 业务数据（内容）分离而产生的，它可以生成特定格式的文档，利用模板引擎来生成前端的HTML代码，模板引擎会提供一套生成HTML代码的程序，之后只需获取用户的数据，放,"/>
    
    
    
    
    <meta property="og:site_name" content="EZzz"/>
    <meta property="og:type" content="object"/>
    <meta property="og:title" content="ssti学习 - EZzz"/>
    <meta property="og:description" content="1.模板引擎
是为了使 用户界面和 业务数据（内容）分离而产生的，它可以生成特定格式的文档，利用模板引擎来生成前端的HTML代码，模板引擎会提供一套生成HTML代码的程序，之后只需获取用户的数据，放,"/>
    
<link rel="stylesheet" href="/css/diaspora.css">

    <script>window.searchDbPath = "/search.xml";</script>
    <link rel="preconnect" href="https://fonts.googleapis.com">
    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
    <link href="https://fonts.googleapis.com/css2?family=Source+Code+Pro&display=swap" rel="stylesheet">
<meta name="generator" content="Hexo 6.3.0"></head>

<body class="loading">
    <span id="config-title" style="display:none">EZzz</span>
    <div id="loader"></div>
    <div id="single">
    <div id="top" style="display: block;">
    <div class="bar" style="width: 0;"></div>
    <a class="iconfont icon-home image-icon" href="javascript:;" data-url="http://example.com"></a>
    <div title="播放/暂停" class="iconfont icon-play"></div>
    <h3 class="subtitle">ssti学习</h3>
    <div class="social">
        <div>
            <div class="share">
                <a title="获取二维码" class="iconfont icon-scan" href="javascript:;"></a>
            </div>
            <div id="qr"></div>
        </div>
    </div>
    <div class="scrollbar"></div>
</div>

    <div class="section">
        <div class="article">
    <div class='main'>
        <h1 class="title">ssti学习</h1>
        <div class="stuff">
            <span>十二月 06, 2022</span>
            

        </div>
        <div class="content markdown">
            <p>1.模板引擎</p>
<p>是为了使 <strong>用户界面</strong>和 业务数据（内容）分离而产生的，它可以生成特定格式的文档，<strong>利用模板引擎来生成前端的HTML代码，模板引擎会提供一套生成HTML代码的程序，之后只需获取用户的数据，放入渲染函数，该数据便会嵌入生成好的HTML页面中</strong>，然后反馈给浏览器，呈现在用户面前</p>
<p>我们需要构造业务数据插入模板文件来进行指令</p>
<p>2.实例</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br></pre></td><td class="code"><pre><span class="line">var template = &#x27;&lt;p&gt;Hello,my name is &lt;%name%&gt;.I am &lt;%age%&gt; years old.&lt;/p&gt;&#x27;;</span><br><span class="line">    用于过滤出以&lt;%开头，%&gt;结尾，并且中间不包含%或&gt;的匹配项</span><br><span class="line">    其目的在于过滤出template中的 &lt;%name%&gt; 和 &lt;%age%&gt;</span><br><span class="line">var regex = /&lt;%([^%]+)?%&gt;/g;</span><br><span class="line">当正则表达式设置 `g` 标志位时，可以多次执行 `exec` 方法来查找同一个字符串中的成功匹配</span><br><span class="line">// 数据</span><br><span class="line">var data =</span><br><span class="line">&#123;</span><br><span class="line">name:&#x27;Deutsh&#x27;,413@</span><br><span class="line">    age:22</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line">// 模板引擎</span><br><span class="line">var TemplateEngine = function (template,data)</span><br><span class="line">&#123;</span><br><span class="line">    // exec使用全局正则表达式意味着在循环中使用，因为它仍然会检索所有匹配的子表达式</span><br><span class="line">    // /regex/.exec()仅返回找到的第一个匹配项</span><br><span class="line">    while (match = regex.exec(template))</span><br><span class="line">    &#123;</span><br><span class="line">        template = template.replace(match[0],data[match[1]])</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    return template;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line">// 最终的执行在此处</span><br><span class="line"></span><br><span class="line">var string = TemplateEngine(template,data)</span><br><span class="line">console.log(string)</span><br></pre></td></tr></table></figure>

<p>因为当正则表达式设置 g 标志位时，可以多次执行exec方法来查找同一个字符串中的成功匹配</p>
<h2 id="测试是否存在ssti"><a href="#测试是否存在ssti" class="headerlink" title="测试是否存在ssti"></a>测试是否存在ssti</h2><p>就是更改请求参数使之承载含有模板引擎语法的 Payload，通过页面渲染返回的内容检测承载的 Payload 是否解析，有解析则可以判定含有 Payload 对应模板引擎注入</p>
<p>Twig实例</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line">　　<span class="keyword">require_once</span> <span class="title function_ invoke__">dirname</span>(<span class="keyword">__FILE__</span>).<span class="string">&#x27;\twig\lib\Twig\Autoloader.php&#x27;</span>;</span><br><span class="line">　　<span class="title class_">Twig_Autoloader</span>::<span class="title function_ invoke__">register</span>(<span class="literal">true</span>);</span><br><span class="line">　　<span class="variable">$twig</span> = <span class="keyword">new</span> <span class="title class_">Twig_Environment</span>(<span class="keyword">new</span> <span class="title class_">Twig_Loader_String</span>());</span><br><span class="line">　　<span class="variable">$output</span> = <span class="variable">$twig</span>-&gt;<span class="title function_ invoke__">render</span>(<span class="string">&quot;Hello &#123;&#123;name&#125;&#125;&quot;</span>, <span class="keyword">array</span>(<span class="string">&quot;name&quot;</span> =&gt; <span class="variable">$_GET</span>[<span class="string">&quot;name&quot;</span>]));</span><br><span class="line">　　<span class="keyword">echo</span> <span class="variable">$output</span>;</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>

<p>若就如我们最开始的例子所说，<strong>若模板引擎渲染的内容受我们控制了</strong>，就不一定了</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="variable">$output</span>=<span class="variable">$twig</span>-&gt;<span class="title function_ invoke__">render</span>(<span class="string">&quot;Hello <span class="subst">&#123;$_GET[&#x27;name&#x27;]&#125;</span>&quot;</span>);</span><br></pre></td></tr></table></figure>

<p>对于Twig模板的变量</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">&#123;&#123;%s&#125;&#125;</span><br></pre></td></tr></table></figure>

<p>除了传递变量外，还可以执行表达式，最简单的表达式就是<code>&#123;&#123;2*2&#125;&#125;</code>，这也是辨认是否存在ssti最基本的指纹，若我们输入4，HTML页面返回其其结果4，就说明该表达式被解析，存在ssti</p>
<p><em>python中的魔术方法</em></p>
<ul>
<li><code>__dict__</code>：保存类实例或对象实例的属性变量键值对字典</li>
<li><code>__class__</code>：返回调用的参数类型</li>
<li><code>__mro__</code>：返回一个包含对象所继承的基类元组，方法在解析时按照元组的顺序解析。 <strong>寻找基类</strong></li>
<li><code>__bases__</code>：返回类型列表 <strong>寻找基类</strong></li>
<li><code>__subclasses__</code>：返回object的子类</li>
<li><code>__init__</code>：类的初始化方法</li>
<li><code>__globals__</code>：函数会以字典类型返回当前位置的全部全局变量 与<code>func_globals</code>等价</li>
</ul>

            <!--[if lt IE 9]><script>document.createElement('audio');</script><![endif]-->
            <audio id="audio" loop="1" preload="auto" controls="controls" data-autoplay="false">
                <source type="audio/mpeg" src="">
            </audio>
            
                <ul id="audio-list" style="display:none">
                    
                        
                            <li title="0" data-url="http://link.hhtjim.com/163/425570952.mp3"></li>
                        
                    
                        
                            <li title="1" data-url="http://link.hhtjim.com/163/425570952.mp3"></li>
                        
                    
                </ul>
            
        </div>
        
        
    <div id="gitalk-container" class="comment link"
		data-enable="false"
        data-ae="false"
        data-ci=""
        data-cs=""
        data-r=""
        data-o=""
        data-a=""
        data-d="false"
    >查看评论</div>


    </div>
    
</div>


    </div>
</div>
</body>


<script src="//lib.baomitu.com/jquery/1.8.3/jquery.min.js"></script>
<script src="/js/plugin.js"></script>
<script src="/js/typed.js"></script>
<script src="/js/diaspora.js"></script>


<link rel="stylesheet" href="/photoswipe/photoswipe.css">
<link rel="stylesheet" href="/photoswipe/default-skin/default-skin.css">


<script src="/photoswipe/photoswipe.min.js"></script>
<script src="/photoswipe/photoswipe-ui-default.min.js"></script>


<!-- Root element of PhotoSwipe. Must have class pswp. -->
<div class="pswp" tabindex="-1" role="dialog" aria-hidden="true">
    <!-- Background of PhotoSwipe. 
         It's a separate element as animating opacity is faster than rgba(). -->
    <div class="pswp__bg"></div>
    <!-- Slides wrapper with overflow:hidden. -->
    <div class="pswp__scroll-wrap">
        <!-- Container that holds slides. 
            PhotoSwipe keeps only 3 of them in the DOM to save memory.
            Don't modify these 3 pswp__item elements, data is added later on. -->
        <div class="pswp__container">
            <div class="pswp__item"></div>
            <div class="pswp__item"></div>
            <div class="pswp__item"></div>
        </div>
        <!-- Default (PhotoSwipeUI_Default) interface on top of sliding area. Can be changed. -->
        <div class="pswp__ui pswp__ui--hidden">
            <div class="pswp__top-bar">
                <!--  Controls are self-explanatory. Order can be changed. -->
                <div class="pswp__counter"></div>
                <button class="pswp__button pswp__button--close" title="Close (Esc)"></button>
                <button class="pswp__button pswp__button--share" title="Share"></button>
                <button class="pswp__button pswp__button--fs" title="Toggle fullscreen"></button>
                <button class="pswp__button pswp__button--zoom" title="Zoom in/out"></button>
                <!-- Preloader demo http://codepen.io/dimsemenov/pen/yyBWoR -->
                <!-- element will get class pswp__preloader--active when preloader is running -->
                <div class="pswp__preloader">
                    <div class="pswp__preloader__icn">
                      <div class="pswp__preloader__cut">
                        <div class="pswp__preloader__donut"></div>
                      </div>
                    </div>
                </div>
            </div>
            <div class="pswp__share-modal pswp__share-modal--hidden pswp__single-tap">
                <div class="pswp__share-tooltip"></div> 
            </div>
            <button class="pswp__button pswp__button--arrow--left" title="Previous (arrow left)">
            </button>
            <button class="pswp__button pswp__button--arrow--right" title="Next (arrow right)">
            </button>
            <div class="pswp__caption">
                <div class="pswp__caption__center"></div>
            </div>
        </div>
    </div>
</div>






</html>
